In what occasion will Honeycomb generate snort signatures ?

summersgone · 05-08-2009, 05:57 PM

Hi guys,
I've just finished setting up honeyd and honeycomb under debian for my 1st time. What I want to ask is what occasion that makes honeycomb generate snort signature ? or just to make it more simple , what should I do to test my honeycomb plugin ?

Thank you very much

unixfool · 05-09-2009, 07:24 AM

Quote:

Originally Posted by summersgone

Hi guys,
I've just finished setting up honeyd and honeycomb under debian for my 1st time. What I want to ask is what occasion that makes honeycomb generate snort signature ? or just to make it more simple , what should I do to test my honeycomb plugin ?

Thank you very much

I've no experience with honeypots or honeynets but if you've set up a honeyPOT on one particular exposed system, it is more than likely set up as host-based. Snort is network-based. It is quite possible that Snort will not alert on a host-based attack. We see this at work all the time. Also, host-based detection is much less 'noisy' than network based.

I'd be relying more on the logs that show on the honeypot if I were looking for some type of host-based attack.

summersgone · 05-09-2009, 10:40 AM

Thank you for your answer , unixfool

But I'm still looking for how do I generate snort signature by using honeycomb ?

THank you

unixfool · 05-09-2009, 01:02 PM

Quote:

Originally Posted by summersgone

Thank you for your answer , unixfool

But I'm still looking for how do I generate snort signature by using honeycomb ?

THank you

I see that Honeycomb is supposed to automatically create sigs:

Here --> http://nms.lcs.mit.edu/HotNets-II/papers/honeycomb.pdf

Here --> http://www.icir.org/christian/honeycomb/

I got that from Google, btw:

http://www.google.com/search?q=snort+honeycomb

summersgone · 05-10-2009, 05:31 PM

Thank you for the answer, unixfool

Apparently I've read all those links .. and I found nothing details about how do i generate snort signature from honeycomb . Does anyone else ever had experience in using honeycomb ?

Thank you

unixfool · 05-12-2009, 10:53 AM

Bad traffic has to happen to be logged. If you're not seeing anything, either your setup isn't working correctly, your placement of your honeypot isn't optimal or something is filtering upstream traffic of bad qualities, before it gets to the honeypot.

Based on the reading I've done (those links I provided you), Honeycomb will autogenerate Snort sigs, but that's all it will do. You will have to either totally expose the honeypot to bad traffic or use something like milw0rm to run exploits against the honeypot, which would get Honeycomb to create a sig.

How do you have things set up? Where is your honeypot set up in relation to the rest of your network? What traffic has it seen so far and is there some indication that Honeycomb isn't working?

I know you're looking for someone else to answer, but no one else has yet to chime in. One issue that I noticed is that your posts aren't clear in what assistance you need. It also isn't clear what you've currently done to troubleshoot this issue and what you expect as assistance from these forums. I'm finding it hard to help you because you've not given much info into your problem and you're also a bit dismissive. It would be easier to help you if you were more open with your issues and less demanding for answers when you haven't provided much to begin with.

unSpawn · 05-12-2009, 05:01 PM

I agree that the first thing to check is proper build and config, the latter should be easy to check using "--verify-config". I ran honeyd+honeycomb out of DHCP with a MAC I temporarily repurposed. Apart from the honeypot being reachable Arpwatch will throw some MAC address and ARP flip flopping warnings which serves as check as well. Throwing some minor nmap fun against it does result in sigs being logged but to what extent they're useful prolly is an eye of the beholder thing:

Code:

alert tcp 240.0.0.0/8 0 -> any 0,7946,13834,14858,32522 (msg: "Honeycomb Day Month HourhMinutesmSecs Year "; ip_proto: "20"; fragbits: R; flags: FSA+; ack: 1746178570; flow: stateless; )    
alert tcp 240.0.0.0/8 0 -> any 0,7946,13834,17930,32522 (msg: "Honeycomb Day Month HourhMinutesmSecs Year "; ip_proto: "20"; fragbits: R; flags: FS+; ack: 1746178570; flow: stateless; )    
alert tcp 240.0.0.0/8 0 -> any 0,7946,14858,40202 (msg: "Honeycomb Day Month HourhMinutesmSecs Year "; ip_proto: "20"; fragbits: R; flags: FSA+; ack: 1746178570; flow: stateless; )    
alert tcp 240.0.0.0/8 0 -> any 0,7946,9226,14090,14858 (msg: "Honeycomb Day Month HourhMinutesmSecs Year "; ip_proto: "20"; fragbits: R; flags: FS+; ack: 1746178570; flow: stateless; )    
alert tcp 240.0.0.0/8 0 -> any 0,7946,9226,14858 (msg: "Honeycomb Day Month HourhMinutesmSecs Year "; ip_proto: "20"; fragbits: R; flags: FS2+; ack: 1746178570; flow: stateless; )    
alert tcp 240.0.0.0/8 0 -> any 0,7946,9226,9482,12298,12554,13834,14090,14602,14858,15626,17930,23050,29194,32522,40202,40458 (msg: "Honeycomb Day Month HourhMinutesmSecs Year "; ip_proto: "20"; fragbits: R; fl
ags: FSA2+; ack: 1746178570; flow: stateless; )    
alert tcp 240.0.0.0/8 0 -> any 0,7946,9482,13834,14090,14858,15626,40202 (msg: "Honeycomb Day Month HourhMinutesmSecs Year "; ip_proto: "20"; fragbits: R; flags: FS+; ack: 1746178570; flow: stateless; )    
alert tcp 240.0.0.0/8 0 -> any 0,9226,9482 (msg: "Honeycomb Day Month HourhMinutesmSecs Year "; ip_proto: "20"; fragbits: R; flags: FSA2; ack: 1746178570; flow: stateless; )    
alert tcp 240.0.0.0/8 0 -> any 0,9226 (msg: "Honeycomb Day Month HourhMinutesmSecs Year "; ip_proto: "20"; fragbits: R; flags: FSA2+; ack: 1746178570; flow: stateless; )    
alert tcp 240.0.0.0/8 0 -> any 0,9482,12298,14858,40458 (msg: "Honeycomb Day Month HourhMinutesmSecs Year "; ip_proto: "20"; fragbits: R; flags: FSA2+; ack: 1746178570; flow: stateless; )    
alert tcp 240.0.0.0/8 0 -> any 0 (msg: "Honeycomb Day Month HourhMinutesmSecs Year "; ip_proto: "20"; fragbits: R; flags: FS2+; ack: 1746178570; flow: stateless; )    
alert tcp 240.0.0.0/8 0 -> any 0 (msg: "Honeycomb Day Month HourhMinutesmSecs Year "; ip_proto: "20"; fragbits: R; flags: FSA2+; ack: 1746178570; flow: stateless; )

unixfool · 05-12-2009, 05:31 PM

Sweet!! Awesome stuff! This should work for the OP also, then.

unSpawn · 05-12-2009, 05:39 PM

Definately should. If it doesn't he should, like you already told him, be way more verbose and post his config, commandline, logs et cetera.

summersgone · 05-19-2009, 04:02 AM

I've also tried to probe my honeycomb host with nmap , and it returns with the signs similar to unSpawn's . And what I am trying to do now is to generate snort signature of rpc-dcom exploit (http://packetstormsecurity.org/0307-exploits/dcom.c).
Here's my honeyd + honeycomb configuration :

http://silenceisdefeat.com/~l41n/ta/honeycomb.conf

And here's the result of the honeycomb.log after I executed dcom exploit to the simulated honeypot host :

http://silenceisdefeat.com/~l41n/ta/honeycomb.log

And it didn't generate any signatures.

I'm still looking for the way how can I generate this rpc-dcom exploit signatures. I'm sorry for still bothering you guys..

Thank you

unSpawn · 05-19-2009, 05:40 PM

I don't know what you want me to do? You could run the exploit against a mcrsft host and capture the packets, then run them through Snort (with the right ruleset) and see if it picks it up (should, as its a known '03 exploit), run it against your honeypot and capture, then compare packets with the mcrsft one. If there's a difference there's something wrong, if not I might run it myself and see if I can elicit a more favourable response.

summersgone · 05-19-2009, 06:38 PM

I just want to know How can I generate rpcdcom exploit snort signatures by using honeycomb ?
coz' this is all i got when I run the rpcdcom exploit against the honeypot :

Quote:

# Signature report at Tue May 19 03:06:56 2009
alert tcp any 0 -> any 0 (msg: "Honeycomb Tue May 19 03h06m46 2009 "; ip_proto: "ip"; flags: F+; flow: stateless; )
alert tcp any 0 -> any 0 (msg: "Honeycomb Tue May 19 03h06m46 2009 "; ip_proto: "ip"; flags: FPA1; flow: stateless;

unSpawn · 05-19-2009, 07:31 PM

OK, so what would you want to invest yourself figuring it out?

summersgone · 05-20-2009, 01:33 AM

anything dude.

unSpawn · 05-20-2009, 03:21 AM

It's appreciated you posted your conf and log but that act itself doesn't constitute troubleshooting. When something goes wrong or doesn't work as advertised you want to start analysing. Bonus points for having an actual environment to baseline it against, else move on to the Next Best Thing (if you don't want to root your mcrsft box or had it patched). Let me know if you disagree with the packet capture approach.